autofixedexplorer[.]co

The domain autofixedexplorer.co was registered on February 21, 2026 and is currently taken offline. DNS resolution points to the IP address 198.12.66.123, which belongs to AS36352 operated by HostPapa and is geolocated in the United States. The site presented the page title “Home | Dapps Leading Synthetic Protocol,” a wording that aligns with a crypto‑focused narrative and matches the listed scam type of a crypto scam. Brand targeting information identifies 1inch as the impersonated entity, confirming a brand‑impersonation motive.

VirusTotal analysis shows that 13 of 93 scanning engines flagged the domain, indicating a moderate level of detection across multiple security vendors. The domain is listed on four public blocklists and is explicitly blocked by PhishDestroy, Polkadot, Enkrypt, and Codeesura, reinforcing its malicious reputation. Reputation services provide extremely low scores: Gridinsoft assigns a trust rating of 0 out of 100, while Scamadviser reports a 1‑point trust score, both reflecting a high likelihood of abuse.

The SSL certificate is identified as R11, but no further certificate details are available. AlienVault OTX records the domain in a single threat‑intel pulse, demonstrating that it has been observed by at least one external intelligence source. No additional public intelligence, such as Safe Browsing entries, is present in the supplied data.

Given the observed infrastructure, the primary indicators of compromise are the domain name, the hosting IP (198.12.66.123), and the associated blocklist entries. Defenders should add the domain and its IP to deny‑list controls, monitor for new sub‑domains under the same registrar, and watch for similar page‑title patterns that reference “Dapps” or “Synthetic Protocol.” Continuous re‑scanning of the domain on VirusTotal and other multi‑engine platforms is recommended to capture any changes in detection status before the domain potentially reappears online.